Skip to content
IndSec Temp Mail

Privacy policy

Last updated: 14 November 2026

What we store

  • Inbox records — the address, a hash of its access token, its creation and expiry times. The raw token is never stored.
  • Messages — sender, recipient, subject, received time, a sanitised copy of the body, and any verification codes or links extracted from it.
  • Attachment metadata — filename, content type and size. File contents are only persisted when object storage is configured.
  • Rate-limit counters — a short-lived counter keyed by a hash of your IP address, used only to prevent abuse. Counters are pruned automatically.

What we do not collect

  • No account, name, password, or phone number. There is no registration.
  • No advertising identifiers, tracking pixels, or third-party analytics scripts by default.
  • No selling or sharing of message content with third parties.

Retention

Messages and inboxes expire. The default inbox lifetime is 90 minutes and can be extended up to the deployment maximum. Expired messages are made inaccessible immediately and removed by a scheduled cleanup job. There is no archive and no recovery.

Access to your inbox

A private inbox is readable only with its access token. Be aware of two cases where this is not true:

  • If you share your inbox link, whoever holds it can read the inbox. The token is the credential.
  • If you enable the public link, anyone with that link can read the inbox without any token. The interface warns you when an inbox is public.

Cookies and local storage

We do not set tracking cookies. The browser stores your inbox token and your theme preference in local storage. Clearing site data removes the stored token, and you will lose access to that inbox.

Remote images in email

Images in received mail are blocked by default and are never loaded directly from the sender. When proxied, the request originates from this service, so the sender does not learn your IP address.

Your rights

You can delete any message, clear an inbox, or delete the whole inbox at any time from the interface. Because there is no account and no identity, we cannot locate data "belonging to you" beyond the token you hold, and we cannot restore it once deleted.

Changes

Material changes to this policy will be reflected in the "last updated" date above. Continuing to use the service after a change constitutes acceptance.

Contact

This is a self-hosted deployment of IndSec Temp Mail. Contact the operator of the domain you are using for privacy enquiries.